From: Wietse Venema (wietseporcupine.org)
Date: Thu Oct 01 2009 - 12:46:51 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Brian Evans - Postfix List:
> Wietse Venema wrote:
> > Miguel Di Ciurcio Filho:
> >
> >> Is there an unofficial Postfix VCS repository? I believe there is not an
> >> official one, is there a reason for that? I'm asking because I want to
> >> keep track of what is going on 2.7 development. Checking the release
> >> notes file or the change log file is not very practical.
> >>
> >
> > There is a collection of PGP-signed tarballs linked off the download
> > webpage. I am not aware of a version control system that provides
> > the integrity guarantees of PGP.
> >
> > Wietse
> >
> PGP? I don't think so.

Then we agree. A system that computes SHA1 without secret key
provides no detection of after-the-fact changes.

        Wietse

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]